Freedom251 › Malware Analysis Sandboxes
ThreatLab
What ThreatLab is
ThreatLab is an on-premises malware analysis sandbox for security teams, with analysis running locally on hardware they control. Its maker, BrightByte Labs LLC, says samples are not uploaded. Isolated Hyper-V sessions let analysts control a live desktop, inspect files and URLs, record sessions, and save or resume work. Sysmon captures process, network, file system, and registry activity in real time, while additional monitoring covers DLL injection, credential access, scheduled tasks, services, ransomware canaries, and the certificate store. A built-in EVTX analyzer includes 2,900+ Sigma rules, timeline views, severity filters, and CSV or JSON export. It produces branded PDF reports with executive summaries, indicators of compromise, severity distribution, and technical details. Users can supply Anthropic, OpenAI, or Google API keys for AI analysis; the maker says keys are encrypted locally with AES-256-CBC. The paid service starts at $84/user/mo and offers a 30-day trial with full access and no credit card required. Windows 10/11 Pro or Enterprise, Hyper-V, at least 16 GB RAM, four CPU threads with virtualization support, and 50 GB free disk space are listed requirements.
Who it suits
ThreatLab suits security teams that need local malware analysis on hardware they control. Teams must meet the listed Windows and hardware requirements.
What it does well
- Analysis runs locally; samples are not uploaded.
- Sessions support live control, recording, saving, and resuming.
- EVTX analysis includes 2,900+ Sigma rules.
- A full-featured 30-day trial needs no credit card.
What to know first
- Windows Pro or Enterprise is required.
- The minimum listed memory is 16 GB RAM.
- Plans above 10 seats require custom pricing.
Limits
A seat represents one machine activation, and plans above 10 seats require contacting the maker for custom pricing. The trial lasts 30 days, while paid plans are limited by purchased seat counts.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Team | Monthly · 3+ seats · Unlimited sessions · All features included · 15% volume discount | $84 a month |
| Starter | Monthly · 1–2 seats · Unlimited sessions · All features included | $99 a month |
As threatlabsandbox.com lists them, read 7 Oct 2026. The maker's own page has the final word.
Getting started
- Open the ThreatLab website
- Prepare a Windows 10/11 Pro or Enterprise 64-bit machine with Hyper-V
- Provide at least 16 GB RAM, four CPU threads with virtualization support, and 50 GB free disk space
- Start the 30-day trial without entering a credit card
- Install the application using the license delivered by email
- Use the web portal to allocate seats and track machines
Verdict
ThreatLab combines local analysis, monitoring, and reporting for security teams with compatible Windows hardware. Review the system requirements and seat needs before selecting a plan.
Questions
Is there a free plan?
No. ThreatLab offers paid plans and a 30-day trial with full feature access.
How much does it cost?
The Team plan is $84 a month for 3+ seats, and Starter is $99 a month for 1–2 seats; both are billed monthly.
Which platforms are supported?
ThreatLab is listed for web and Windows, with an on-premises deployment model.
What does the trial require?
The 30-day trial includes full feature access and does not require a credit card. The maker says the license arrives by email within 12 hours.
Can it analyze URLs and network traffic?
Yes. URL analysis and network traffic analysis are listed capabilities, along with IOC extraction.
Facts from ThreatLab's own pages
- AI integrations
- Users can provide API keys from Anthropic, OpenAI, or Google for AI analysis; the page says keys are encrypted locally with AES-256-CBC. · threatlabsandbox.com, 7 Oct 2026
- Data handling
- The maker says samples are not uploaded and analysis runs locally on the user's hardware. · threatlabsandbox.com, 7 Oct 2026
- Event log analysis
- The built-in EVTX analyzer includes 2,900+ Sigma rules and supports timeline views, severity filtering, and CSV or JSON export. · threatlabsandbox.com, 7 Oct 2026
- Interactive analysis
- Its isolated Hyper-V sessions provide live desktop control, file and URL analysis, session recording, and save and resume. · threatlabsandbox.com, 7 Oct 2026
- Maker
- The site identifies the maker as BrightByte Labs LLC. · threatlabsandbox.com, 7 Oct 2026
- Management and support
- A web management portal handles licenses, seat allocation, machine tracking, downloads, and documentation; the app also has issue reporting with optional log attachment. · threatlabsandbox.com, 7 Oct 2026
- Monitoring
- Sysmon monitoring captures process, network, file system, and registry events in real time. · threatlabsandbox.com, 7 Oct 2026
- Purpose
- ThreatLab is a local malware analysis sandbox for security teams, with analysis running on hardware they control. · threatlabsandbox.com, 7 Oct 2026
- Reporting
- It generates PDF reports with executive summaries, indicators of compromise, severity distribution, and technical details, with custom branding. · threatlabsandbox.com, 7 Oct 2026
- Seat limits
- A seat is one machine activation, and the maker says plans above 10 seats require contacting it for custom pricing. · threatlabsandbox.com, 7 Oct 2026
- System requirements
- The maker lists Windows 10/11 Pro or Enterprise 64-bit with Hyper-V, at least 16 GB RAM, 4 or more CPU threads with virtualization support, and 50 GB free disk space. · threatlabsandbox.com, 7 Oct 2026
- Threat detection
- The product includes DLL injection, credential access, scheduled task, service, ransomware canary, and certificate store monitoring. · threatlabsandbox.com, 7 Oct 2026
- Trial
- The maker offers a 30-day trial with full feature access and no credit card required; it says the license arrives by email within 12 hours. · threatlabsandbox.com, 7 Oct 2026
- VPN
- ThreatLab offers WireGuard VPN exit nodes in the US, UK, Germany, and Spain, with a kill switch that blocks internet access if the tunnel drops. · threatlabsandbox.com, 7 Oct 2026
Where ThreatLab stands on Freedom251
- Malware Analysis Sandboxes#12 of 27